3 ms·

There's a risk. Have you ever had your credit card number expire? If a merchant has repeat billing, you don't even need to update with the new date and cvv.

There's a risk. Have you ever had your credit card number expire? If a merchant has repeat billing, you don't even need to update with the new date and cvv. Code changes must now be made to make sure I don't end up responsible for someone's else bill because my card expired and someone issued the same card number with a different expiration date and cvv.

quelltext 6y ago
This is a simple issue to solve if you have all the issuers in line/on the same page. Issuers simply need tabs on this. This means, a) they only allow this for merchants that have had previous transactions. b) They reset this when a card is reused (owner of the number changes). Ultimately you just need a system that turns on stricter checks when reuse-induced issues are likely. Once a card is reused the issuer simply needs to turn off the recurring billing laxness until the card gets close to expiration again, i.e. a few years, which should suffice to detect any sort of problematic patterns. This wouldn't affect the customer at all as any legitimate transaction would have been made with up to date expiry and CVV.
- segmondy 6y ago
  It's never a simple issue to get all banks to update their systems. It will take decades!
phantom784 6y ago
That's done with a credit card updating service - not by just ignoring the CVV/expiration. If the same number were reassigned to someone else, the subscription wouldn't transfer.
- avianlyric 6y ago
  That isn’t true. Most banks don’t support the updating services that exist. These subscriptions are supported by look at if the payment appeared as a “card-on-file” payment, and many banks will just keep accepting charges to expired cards. If you’re lucky they’ll be using the PAN + expiry date to uniquely identify the card the payment belongs too. The CVV isn’t stored by the merchant or their processor, and is only used for the initial checkout flow.
  - GoblinSlayer 6y ago
    Well, if bank ignores everything and just throws your money out, ask the regulator to revoke the bank's license.
    - avianlyric 6y ago
      In most countries as a customer you’re not liable for fraud that occurs as a result of your banks failures. In the EU this sort of behaviour is now heavily frowned upon, and with the slow roll out of Strong Customer Authentication will become unacceptable. With banks needing to prove that they’re compliant. As for the rest of the world, regulators don’t always act with the interest of customer in mind. The US has a few notable examples of regulators protecting companies rather than consumers.

quelltext 6y ago

This is a simple issue to solve if you have all the issuers in line/on the same page. Issuers simply need tabs on this. This means, a) they only allow this for merchants that have had previous transactions. b) They reset this when a card is reused (owner of the number changes). Ultimately you just need a system that turns on stricter checks when reuse-induced issues are likely. Once a card is reused the issuer simply needs to turn off the recurring billing laxness until the card gets close to expiration again, i.e. a few years, which should suffice to detect any sort of problematic patterns. This wouldn't affect the customer at all as any legitimate transaction would have been made with up to date expiry and CVV.

segmondy 6y ago
It's never a simple issue to get all banks to update their systems. It will take decades!

phantom784 6y ago

That's done with a credit card updating service - not by just ignoring the CVV/expiration. If the same number were reassigned to someone else, the subscription wouldn't transfer.

avianlyric 6y ago
That isn’t true. Most banks don’t support the updating services that exist. These subscriptions are supported by look at if the payment appeared as a “card-on-file” payment, and many banks will just keep accepting charges to expired cards. If you’re lucky they’ll be using the PAN + expiry date to uniquely identify the card the payment belongs too. The CVV isn’t stored by the merchant or their processor, and is only used for the initial checkout flow.
- GoblinSlayer 6y ago
  Well, if bank ignores everything and just throws your money out, ask the regulator to revoke the bank's license.
  - avianlyric 6y ago
    In most countries as a customer you’re not liable for fraud that occurs as a result of your banks failures. In the EU this sort of behaviour is now heavily frowned upon, and with the slow roll out of Strong Customer Authentication will become unacceptable. With banks needing to prove that they’re compliant. As for the rest of the world, regulators don’t always act with the interest of customer in mind. The US has a few notable examples of regulators protecting companies rather than consumers.